Do gamers have a larger fingerprintable surface?
Watch out nerds!
I was wondering, do gamers have a larger fingerprintable surface than non-gamers? Obviously yes.
So what causes this?
PC gamers are likely to have outlier hardware/peripherals, with the ones most easily measurable in a browser environment being (rougly in order of ease of testing):
- Monitor
- GPU
- Mouse
- Keyboard (hard)
- Gamepad (double hard)
Monitor refresh rate
Modern devices are starting to get more variance in monitor refresh rate, with some phones and even macbook pros having refresh rates of 120Hz. These still don’t have that much variance in terms of client side signal though - my macbook pro looks very similar to yours in terms of fingerprint.
The monitor plugged into my pc however - 144Hz and 21:9 aspect ratio. Unusual enough that I’m fairly easy to identify. If you want to know somebody’s refresh rate, just ask them to do:
function measureRefreshRate(samples = 60) {
return new Promise(resolve => {
const times = [];
function tick(now) {
times.push(now);
if (times.length < samples) {
requestAnimationFrame(tick);
} else {
const deltas = times.slice(1).map((t, i) => t - times[i]);
const avgMs = deltas.reduce((a, b) => a + b) / deltas.length;
resolve(Math.round(1000 / avgMs)); // Hz
}
}
requestAnimationFrame(tick);
});
}
Interestingly, I get the same result of 144Hz even when on my secondry monitor, which is only 60Hz. This adds a nice bit of stability to the use of refresh rate as a fingerprint. Devices with variable refresh rates depending on battery level admittedly ruins some of this stability.
CS2 pros are using monitors that go up to 600Hz. Watch out Zywoo you’re going to get fingerprinted!
Gaming mice
Again it’s something to do with Hz’s. The polling rate of non gaming mice tends to be pretty low, normally 125Hz. High quality mice can poll up to 8kHz. I struggled to put together a consistent measure of this over 1kHz despite using the 8kHz setting on my mouse. If you’re able to find a way to measure up to that high a polling rate in browser in mice, please share the code with me.
GPU
GPUs can be somewhat niche, though not massively so in practice typically. Firefox tends to reveal a little more relating to gpu details than chrome, however both are suficcient to identify the GPU itself.
In general though, Nvidia Geforce RTX 3080 tells me a lot more about you than Integrated Intel Graphics does.
Keyboard
If you can find a way to convince a user to press more than 6 keys down at once (mash your keyboard to complete this captcha?) then you can identify whether they’re using a keyboard with greater than 6 key rollover. Gaming mechanical keyboards use custom drivers or NKRO mode to report greater numbers of simultaneous keypresses.
Imagining the UX on this one brings a smile to my face.
Similarly, navigator.getGamepads() will expose whether there’s a gamepad plugged in. Again the trick here is for it to be active the gamepad has to give a signal to the pc while the browser is on the current page (press triangle, square, circle circle to complete this captcha???).
HDR support
A big stretch to call this a gaming specific signal, but an interesting signal nonetheless!
function getHDRSupport() {
return {
hdr: matchMedia('(dynamic-range: high)').matches,
// Also check color gamut — HDR usually implies wide gamut
p3: matchMedia('(color-gamut: p3)').matches,
rec2020: matchMedia('(color-gamut: rec2020)').matches,
// Video-specific (newer, less supported)
videoHDR: matchMedia('(video-dynamic-range: high)').matches,
};
}
Laptop or Desktop
Only noobs game on laptop. Use navigator.getBattery() to identify and bully them.
Peripherals
Doing much with it would require some analysis of representative data, but, in my opinion, navigator.mediaDevices?.enumerateDevices) gives too much data away while remaining permissionless from the client’s point of view.
Who cares
Me! I can see a few reasons all this would be of interest:
- Simply another signal for a suite of client side fingerprinting tests. CreepJS for example already implements checks for colour gamut, battery, enumerateDevices and GPU
- Serving targeted ads to gamers? I’m not sure if they’re a segment of interest when serving ads, though I would assume that a fancy gaming computer is a strong sign of disposable income
- Automated requirement checking of some form - your pc can play this game/mine x amount of ETH/process local LLM models at Y tokens per second. This seems like more of a fun trick than anything useful though.
I want to play around with some of these fingerprinting signals
So did I! So I fed this info to Claude and got it to produce some slop. Check it out here. It’s quite rough around the edges, but demonstrates some of the topics discussed above.